0

We have a client with a remote site with a 10.0.9.0/24 network. The DHCP scope on this network is nearly exhausted, with only about 20 addresses available. We could possibly increase this to 30 by re-IPing some static devices and shrinking our exclusion range. This may not be a long-term solution.

I've been tasked with engineering a long-term solution. Caveat: It's been 14 years since I did any serious Cisco router/switch configuration.

It was recommended that I create 3 additional VLANs with 3 additional subnets (10.0.10.0, etc). This has the advantage of allowing me to leave most of my static assigned IPs alone, but requires a ton of switch and router configuration for inter-VLAN routing. With a single DHCP server, this complicates the DHCP setup as well, with multiple DHCP scopes and a superscope. Most of this configuration can be done with minimal or no downtime for clients.

The other option is to resubnet the site to 10.0.10.0/23. I would have to re-IP every static device, but changing IPs and subnet masks is a bit easier (for me) than configuring multiple VLANs and inter-VLAN routing across 4 different subnets. (Note: The 10.0.8.0/24 network is in use at another site, so we can't use 10.0.8.0/23 to avoid changing the 10.0.9.* IP addresses at this site.) This configuration will require significant downtime as network devices are re-IPd.

My understanding between the two solutions is that a single /23 subnet has a larger broadcast domain (510 clients) where as 4 /24 subnets have 4 smaller broadcast domains. With ~220 devices, I don't see broadcast traffic as a significant factor. The switches in use are Cisco 2960-s models with limited layer-3 capability. Therefore most of the inter-VLAN routing would fall back on the site's router, increasing router overhead.

Is there an industry standard preferred method for resolving DHCP scope exhaustion? Are there any pros/cons to either solution that I haven't mentioned here that may make a difference? Is there a third, better solution?

More Info:
Since whatever I do, I'm re-engineering this network, I'm trying to identify what the "right" solution is. If this were a new network that would support more than 254 devices, would it be better to build a single /23 subnet or multiple /24 subnets?

If I remembered all of my CCNA training from 2002, adding new /24 subnets and VLANs might be trivial. But I know from experience that it's not so trivial to maintain. I am looking for advice as to which solution will cause me the least amount of pain now and a year from now.

Improve this question

1 Answer 1

Reset to default
2

I've been tasked with engineering a long-term solution. Caveat: It's been 14 years since I did any serious Cisco router/switch configuration.

If you are tasked with creating a long-term solution, you should really use your first option:

It was recommended that I create 3 additional VLANs with 3 additional subnets (10.0.10.0, etc). This has the advantage of allowing me to leave most of my static assigned IPs alone, but requires a ton of switch and router configuration for inter-VLAN routing. With a single DHCP server, this complicates the DHCP setup as well, with multiple DHCP scopes and a superscope. Most of this configuration can be done with minimal or no downtime for clients.

I think you really overestimate the work involved. The network engineers I know really, really hate to readdress end-devices, and they would much rather make the few simple changes to the network to add a few VLANs.

Improve this answer
6
  • I appreciate the response. "Simple" is a relative term in this case, primarily determined by my experience. Changing IPs on a half dozen endpoints is easy. Adding VLANs would require me to spend a lot of time relearning Cisco CLI nonsense I haven't used in a decade, plus documenting which switch ports each endpoint was connected to for correct VLAN assignment. That being said, I'm primarily asking what the right way is. If this were a new network with ~250 devices, is it better to build it with a single /23 subnet or multiple /24 subnets?
    – Thomas
    Aug 2, 2016 at 20:34
  • The correct way, according to the best practice by Cisco, is to have each access switch on its own VLAN, and to not have VLANs spread across multiple switches. That is to say, each VLAN only goes to one access switch, but you could have multiple VLANs on one switch. People get confused about this and think it is one VLAN per switch, but it is really one switch per VLAN. This eliminates a lot of STP problems, and a broadcast storm will not bring down the whole network.
    – Ron Maupin
    Aug 2, 2016 at 23:43
  • I found a source for that best practice: cisco.com/c/en/us/td/docs/solutions/Enterprise/Security/…. It complicates things enormously. This site has 9 switches (currently on 1 VLAN). That best practice means creating 9 VLANs instead of 2 or 3. I understand the desire to limit broadcast domains, but that seems like overkill.
    – Thomas
    Aug 3, 2016 at 20:49
  • @Thomas, it's not really about limiting the broadcast domain, although that is a benefit. It is about limiting STP and the ability of an STP problem to bring down the entire site. With a single switch per VLAN, you limit each VLAN STP to a single switch, and something like accidentally connecting two access switches together will not crash the whole site. Recovering from an STP problem is not easy or fun, nor is discovering the root cause.
    – Ron Maupin
    Aug 3, 2016 at 20:53
  • Really, having 3 VLANs or 9 VLAN is really no different in difficulty. You simply create an SVI for each VLAN, and the trunk ports where the access switches connect get limited to the VLAN(s) only for that switch (one line of configuration on the interface). It is pretty easy to prevent something that could be devastating.
    – Ron Maupin
    Aug 3, 2016 at 20:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .